@winspan/claude-forge 8.51.1 → 8.54.3

package/tests/unit/queue.test.ts

@@ -1,272 +0,0 @@
-/**
- * Unit tests for src/core/queue/index.ts
- *
- * All filesystem operations use a temp directory so tests are hermetic.
- * We monkey-patch the QUEUE_DIR / DEAD_DIR constants via module internals
- * by pointing the OS homedir to a temp dir through env injection, or by
- * calling the functions directly with the temp dir substituted.
- *
- * Since the module computes QUEUE_DIR at import time from os.homedir(), we
- * instead test the exported functions by redirecting them to a temp dir
- * via environment manipulation, OR we restructure to accept a dir parameter.
- *
- * For simplicity and correctness: we use the actual exported constants and
- * temporarily redirect by overriding the module. Instead of that complexity,
- * we'll test the functions with real temp dirs by using the SQLiteStorage
- * integration path. For pure prune/enqueue tests we temporarily substitute
- * the real QUEUE_DIR by setting HOME.
- */
-
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync, utimesSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-
-// ── We test the queue module with HOME overridden ──────────────────────────
-// Reset the module registry for each test block to pick up the new HOME.
-
-describe('Queue module', () => {
-  let tempHome: string;
-  let queueDir: string;
-  let deadDir: string;
-  let originalHome: string | undefined;
-
-  beforeEach(async () => {
-    // Override HOME so that the queue module uses our temp dir
-    originalHome = process.env['HOME'];
-    tempHome = mkdtempSync(join(tmpdir(), 'forge-queue-test-'));
-    process.env['HOME'] = tempHome;
-
-    queueDir = join(tempHome, '.claude-forge', 'queue');
-    deadDir = join(queueDir, 'dead');
-    mkdirSync(queueDir, { recursive: true });
-    mkdirSync(deadDir, { recursive: true });
-
-    // Clear module cache so QUEUE_DIR / DEAD_DIR picks up new HOME
-    vi.resetModules();
-  });
-
-  afterEach(() => {
-    process.env['HOME'] = originalHome;
-    rmSync(tempHome, { recursive: true, force: true });
-    vi.resetModules();
-  });
-
-  // ── enqueueEvent ─────────────────────────────────────────────────────────
-
-  it('enqueueEvent writes a file that can be parsed as JSON', async () => {
-    const { enqueueEvent } = await import('../../src/core/queue/index.js');
-
-    const event = {
-      session_id: 'test-001',
-      project_path: '/tmp/proj',
-      timestamp: new Date().toISOString(),
-      hook_type: 'UserPromptSubmit' as const,
-      user_prompt: 'hello',
-    };
-
-    enqueueEvent(event);
-
-    const files = readdirSync(queueDir).filter((f) => f.endsWith('.json'));
-    expect(files).toHaveLength(1);
-
-    const raw = await import('node:fs/promises').then((m) =>
-      m.readFile(join(queueDir, files[0]!), 'utf8'),
-    );
-    const parsed = JSON.parse(raw);
-    expect(parsed.session_id).toBe('test-001');
-    expect(parsed.event_id).toBeDefined(); // auto-assigned
-  });
-
-  it('enqueueEvent preserves existing event_id', async () => {
-    const { enqueueEvent } = await import('../../src/core/queue/index.js');
-
-    const event = {
-      session_id: 'test-002',
-      project_path: '/tmp',
-      timestamp: new Date().toISOString(),
-      hook_type: 'PreToolUse' as const,
-      event_id: '33333333-3333-4333-8333-333333333333',
-    };
-
-    enqueueEvent(event);
-
-    const files = readdirSync(queueDir).filter((f) => f.endsWith('.json'));
-    const raw = await import('node:fs/promises').then((m) =>
-      m.readFile(join(queueDir, files[0]!), 'utf8'),
-    );
-    const parsed = JSON.parse(raw);
-    expect(parsed.event_id).toBe('33333333-3333-4333-8333-333333333333');
-  });
-
-  // ── pruneQueue ────────────────────────────────────────────────────────────
-
-  it('pruneQueue removes oldest files when >= MAX_FILES', async () => {
-    const { pruneQueue, MAX_FILES } = await import('../../src/core/queue/index.js');
-
-    // Write MAX_FILES + 10 dummy files
-    const total = MAX_FILES + 10;
-    for (let i = 0; i < total; i++) {
-      const ts = new Date(Date.now() + i * 1000).toISOString().replace(/[:.]/g, '-').replace('Z', 'Z');
-      writeFileSync(join(queueDir, `${ts}-event-${i}.json`), '{}');
-    }
-
-    pruneQueue();
-
-    const remaining = readdirSync(queueDir).filter((f) => f.endsWith('.json'));
-    expect(remaining.length).toBeLessThanOrEqual(MAX_FILES);
-  });
-
-  it('pruneQueue keeps oldest files below MAX_FILES', async () => {
-    const { pruneQueue, MAX_FILES } = await import('../../src/core/queue/index.js');
-
-    // Write MAX_FILES - 1 files: prune should NOT remove any
-    for (let i = 0; i < MAX_FILES - 1; i++) {
-      const ts = new Date(Date.now() + i * 1000).toISOString().replace(/[:.]/g, '-').replace('Z', 'Z');
-      writeFileSync(join(queueDir, `${ts}-event-${i}.json`), '{}');
-    }
-
-    pruneQueue();
-
-    const remaining = readdirSync(queueDir).filter((f) => f.endsWith('.json'));
-    expect(remaining.length).toBe(MAX_FILES - 1);
-  });
-
-  // ── replayQueue ───────────────────────────────────────────────────────────
-
-  it('replayQueue replays events into storage and deletes queue files', async () => {
-    const { replayQueue, enqueueEvent } = await import('../../src/core/queue/index.js');
-    const { SQLiteStorage } = await import('../../src/core/storage/sqlite.js');
-
-    const dbPath = join(tempHome, 'test.db');
-    const storage = new SQLiteStorage(dbPath);
-
-    const event = {
-      session_id: 'replay-session-1',
-      project_path: '/tmp/proj',
-      timestamp: new Date().toISOString(),
-      hook_type: 'UserPromptSubmit' as const,
-      user_prompt: 'replayed',
-      event_id: '11111111-1111-4111-8111-111111111111',
-    };
-    enqueueEvent(event);
-
-    const result = await replayQueue(storage);
-
-    expect(result.replayed).toBe(1);
-    expect(result.skipped).toBe(0);
-    expect(result.dead).toBe(0);
-
-    const files = readdirSync(queueDir).filter((f) => f.endsWith('.json'));
-    expect(files).toHaveLength(0);
-
-    const events = storage.queryEvents({ session_id: 'replay-session-1' });
-    expect(events).toHaveLength(1);
-    expect(events[0]!.user_prompt).toBe('replayed');
-
-    storage.close();
-  });
-
-  it('replayQueue silently skips duplicate event_id (UNIQUE constraint)', async () => {
-    const { replayQueue, enqueueEvent } = await import('../../src/core/queue/index.js');
-    const { SQLiteStorage } = await import('../../src/core/storage/sqlite.js');
-
-    const dbPath = join(tempHome, 'dedup.db');
-    const storage = new SQLiteStorage(dbPath);
-
-    const event = {
-      session_id: 'dedup-session',
-      project_path: '/tmp',
-      timestamp: new Date().toISOString(),
-      hook_type: 'PreToolUse' as const,
-      event_id: '22222222-2222-4222-8222-222222222222',
-    };
-
-    // Pre-write event into DB directly
-    storage.writeEvent(event);
-
-    // Enqueue the same event
-    enqueueEvent(event);
-
-    const result = await replayQueue(storage);
-
-    expect(result.skipped).toBe(1);
-    expect(result.replayed).toBe(0);
-    expect(result.dead).toBe(0);
-
-    // Queue file should be removed
-    const files = readdirSync(queueDir).filter((f) => f.endsWith('.json'));
-    expect(files).toHaveLength(0);
-
-    // DB still has exactly one copy
-    const events = storage.queryEvents({ session_id: 'dedup-session' });
-    expect(events).toHaveLength(1);
-
-    storage.close();
-  });
-
-  it('replayQueue moves corrupt JSON to dead-letter dir', async () => {
-    const { replayQueue } = await import('../../src/core/queue/index.js');
-    const { SQLiteStorage } = await import('../../src/core/storage/sqlite.js');
-
-    const dbPath = join(tempHome, 'corrupt.db');
-    const storage = new SQLiteStorage(dbPath);
-
-    writeFileSync(join(queueDir, '2020-01-01T00-00-00-000Z-bad.json'), 'NOT_JSON{{{');
-
-    const result = await replayQueue(storage);
-
-    expect(result.dead).toBe(1);
-    expect(result.replayed).toBe(0);
-
-    const deadFiles = readdirSync(deadDir).filter((f) => f.endsWith('.json'));
-    expect(deadFiles).toHaveLength(1);
-
-    storage.close();
-  });
-
-  it('replayQueue moves TTL-expired files to dead-letter dir', async () => {
-    const { replayQueue, TTL_DAYS } = await import('../../src/core/queue/index.js');
-    const { SQLiteStorage } = await import('../../src/core/storage/sqlite.js');
-
-    const dbPath = join(tempHome, 'ttl.db');
-    const storage = new SQLiteStorage(dbPath);
-
-    const filename = '2000-01-01T00-00-00-000Z-old-event.json';
-    const filePath = join(queueDir, filename);
-    writeFileSync(filePath, JSON.stringify({
-      session_id: 'old',
-      project_path: '/tmp',
-      timestamp: '2000-01-01T00:00:00.000Z',
-      hook_type: 'Notification',
-      event_id: '44444444-4444-4444-8444-444444444444',
-    }));
-
-    // Set mtime to TTL_DAYS + 1 days ago
-    const oldTime = new Date(Date.now() - (TTL_DAYS + 1) * 24 * 60 * 60 * 1000);
-    utimesSync(filePath, oldTime, oldTime);
-
-    const result = await replayQueue(storage);
-
-    expect(result.dead).toBe(1);
-    expect(result.replayed).toBe(0);
-
-    const deadFiles = readdirSync(deadDir).filter((f) => f.endsWith('.json'));
-    expect(deadFiles).toHaveLength(1);
-
-    storage.close();
-  });
-
-  it('replayQueue returns zeros when queue is empty', async () => {
-    const { replayQueue } = await import('../../src/core/queue/index.js');
-    const { SQLiteStorage } = await import('../../src/core/storage/sqlite.js');
-
-    const dbPath = join(tempHome, 'empty.db');
-    const storage = new SQLiteStorage(dbPath);
-
-    const result = await replayQueue(storage);
-    expect(result).toEqual({ replayed: 0, skipped: 0, dead: 0 });
-
-    storage.close();
-  });
-});

package/tests/unit/router.test.ts

@@ -1,138 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest';
-import { createMockAI, createFailingMockAI } from '../helpers/mock-ai.js';
-
-describe('Router - Agent Routing', () => {
-  describe('MockAIProvider', () => {
-    it('should return mock response', async () => {
-      const ai = createMockAI('test response');
-      const result = await ai.complete('test prompt');
-      expect(result).toBe('test response');
-    });
-
-    it('should track call history', async () => {
-      const ai = createMockAI('response');
-      await ai.complete('prompt 1');
-      await ai.complete('prompt 2');
-
-      expect(ai.getCallCount()).toBe(2);
-      expect(ai.getLastPrompt()).toBe('prompt 2');
-    });
-
-    it('should return multiple responses in sequence', async () => {
-      const ai = createMockAI();
-      ai.addResponse('response 1');
-      ai.addResponse('response 2');
-
-      const result1 = await ai.complete('prompt 1');
-      const result2 = await ai.complete('prompt 2');
-
-      expect(result1).toBe('mock response');
-      expect(result2).toBe('response 1');
-    });
-
-    it('should reset state', async () => {
-      const ai = createMockAI('response');
-      await ai.complete('prompt');
-      expect(ai.getCallCount()).toBe(1);
-
-      ai.reset();
-      expect(ai.getCallCount()).toBe(0);
-    });
-  });
-
-  describe('Error handling', () => {
-    it('should handle AI provider errors', async () => {
-      const ai = createFailingMockAI('Test error');
-      await expect(ai.complete('prompt')).rejects.toThrow('Test error');
-    });
-  });
-
-  describe('Intent classification', () => {
-    it('should classify simple prompts', () => {
-      const prompts = [
-        { text: 'fix the bug', expectedIntent: 'bug_fix' },
-        { text: 'add new feature', expectedIntent: 'feature' },
-        { text: 'refactor the code', expectedIntent: 'refactor' },
-        { text: 'optimize performance', expectedIntent: 'performance' },
-      ];
-
-      prompts.forEach(({ text, expectedIntent }) => {
-        // Simple keyword-based classification for testing
-        let intent = 'unknown';
-        if (text.includes('fix') || text.includes('bug')) intent = 'bug_fix';
-        else if (text.includes('add') || text.includes('feature')) intent = 'feature';
-        else if (text.includes('refactor')) intent = 'refactor';
-        else if (text.includes('optimize') || text.includes('performance')) intent = 'performance';
-
-        expect(intent).toBe(expectedIntent);
-      });
-    });
-  });
-
-  describe('Agent selection', () => {
-    it('should select appropriate agent for bug fix', () => {
-      const intent = 'bug_fix';
-      const agent = selectAgent(intent);
-      expect(agent).toBe('coder');
-    });
-
-    it('should select appropriate agent for feature', () => {
-      const intent = 'feature';
-      const agent = selectAgent(intent);
-      expect(agent).toBe('feature-developer');
-    });
-
-    it('should select appropriate agent for refactor', () => {
-      const intent = 'refactor';
-      const agent = selectAgent(intent);
-      expect(agent).toBe('refactor-specialist');
-    });
-
-    it('should default to coder for unknown intent', () => {
-      const intent = 'unknown';
-      const agent = selectAgent(intent);
-      expect(agent).toBe('coder');
-    });
-  });
-
-  describe('Routing decision', () => {
-    it('should create routing decision with metadata', () => {
-      const decision = {
-        intent: 'bug_fix',
-        agent: 'coder',
-        confidence: 0.9,
-        timestamp: Date.now(),
-      };
-
-      expect(decision.intent).toBe('bug_fix');
-      expect(decision.agent).toBe('coder');
-      expect(decision.confidence).toBeGreaterThan(0.8);
-      expect(decision.timestamp).toBeGreaterThan(0);
-    });
-
-    it('should handle low confidence routing', () => {
-      const decision = {
-        intent: 'unknown',
-        agent: 'coder',
-        confidence: 0.3,
-        fallback: true,
-      };
-
-      expect(decision.fallback).toBe(true);
-      expect(decision.confidence).toBeLessThan(0.5);
-    });
-  });
-});
-
-// Helper function for agent selection
-function selectAgent(intent: string): string {
-  const mapping: Record<string, string> = {
-    bug_fix: 'coder',
-    feature: 'feature-developer',
-    refactor: 'refactor-specialist',
-    performance: 'coder',
-    investigation: 'researcher',
-  };
-
-  return mapping[intent] || 'coder';
-}

package/tests/unit/security.test.ts

@@ -1,128 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { resolvePatchTarget } from '../../src/web/routes/types.js';
-import fs from 'node:fs';
-import path from 'node:path';
-import { tmpdir } from 'node:os';
-
-describe('Security - Path Traversal Prevention', () => {
-  describe('resolvePatchTarget', () => {
-    it('should reject path traversal with ../', () => {
-      expect(() => resolvePatchTarget('skill', '../../../etc/passwd')).toThrow('Invalid target name');
-    });
-
-    it('should reject path traversal with ..\\', () => {
-      expect(() => resolvePatchTarget('skill', '..\\..\\..\\windows\\system32')).toThrow('Invalid target name');
-    });
-
-    it('should reject absolute paths with /', () => {
-      expect(() => resolvePatchTarget('skill', '/etc/passwd')).toThrow('Invalid target name');
-    });
-
-    it('should reject absolute paths with \\', () => {
-      expect(() => resolvePatchTarget('skill', '\\windows\\system32')).toThrow('Invalid target name');
-    });
-
-    it('should reject paths with .. in the middle', () => {
-      expect(() => resolvePatchTarget('skill', 'foo/../bar')).toThrow('Invalid target name');
-    });
-
-    it('should accept valid skill names', () => {
-      const result = resolvePatchTarget('skill', 'my-skill');
-      expect(result.filePath).toContain('my-skill.md');
-      expect(result.filePath).not.toContain('..');
-    });
-
-    it('should accept skill names with underscores and hyphens', () => {
-      const result = resolvePatchTarget('skill', 'my_skill-v2');
-      expect(result.filePath).toContain('my_skill-v2.md');
-    });
-
-    it('should reject empty target names', () => {
-      expect(() => resolvePatchTarget('skill', '')).toThrow('Invalid target name');
-    });
-  });
-});
-
-describe('Security - Input Validation', () => {
-  describe('Skill name validation patterns', () => {
-    const invalidNames = [
-      '../../../etc/passwd',
-      '..\\..\\..\\windows\\system32',
-      '/etc/passwd',
-      '\\windows\\system32',
-      'foo/../bar',
-      'foo\\..\\bar',
-      '..',
-      './foo',
-      '.\\foo',
-    ];
-
-    invalidNames.forEach(name => {
-      it(`should reject invalid name: ${name}`, () => {
-        expect(() => resolvePatchTarget('skill', name)).toThrow();
-      });
-    });
-
-    const validNames = [
-      'my-skill',
-      'my_skill',
-      'skill123',
-      'SKILL',
-      'my-skill-v2',
-      'my_skill_v2',
-    ];
-
-    validNames.forEach(name => {
-      it(`should accept valid name: ${name}`, () => {
-        expect(() => resolvePatchTarget('skill', name)).not.toThrow();
-      });
-    });
-  });
-});
-
-describe('Security - Git Command Injection Prevention', () => {
-  describe('projectPath validation', () => {
-    it('should reject relative paths', () => {
-      const relativePath = '../some/project';
-      expect(path.isAbsolute(relativePath)).toBe(false);
-    });
-
-    it('should accept absolute paths', () => {
-      const absolutePath = '/home/user/project';
-      expect(path.isAbsolute(absolutePath)).toBe(true);
-    });
-
-    it('should validate directory existence', () => {
-      const nonExistentPath = '/this/path/does/not/exist/12345';
-      expect(fs.existsSync(nonExistentPath)).toBe(false);
-    });
-
-    it('should validate .git directory existence', () => {
-      const tempDir = tmpdir();
-      const gitDir = path.join(tempDir, '.git');
-
-      // tmpdir exists but likely doesn't have .git
-      expect(fs.existsSync(tempDir)).toBe(true);
-      // Most temp dirs won't have .git
-      if (!fs.existsSync(gitDir)) {
-        expect(fs.existsSync(gitDir)).toBe(false);
-      }
-    });
-
-    it('should handle path with special characters safely', () => {
-      // These should be rejected as non-existent or invalid
-      const dangerousPaths = [
-        '/tmp; rm -rf /',
-        '/tmp && echo pwned',
-        '/tmp | cat /etc/passwd',
-        '/tmp`whoami`',
-        '/tmp$(whoami)',
-      ];
-
-      dangerousPaths.forEach(p => {
-        // These paths should fail existence check
-        expect(fs.existsSync(p)).toBe(false);
-      });
-    });
-  });
-});